Uncontrolled Recursion Vulnerability in Apache bRPC Affects Remote Servers

CVE-2026-82230

What is CVE-2026-82230?

The mcpack2pb component of Apache bRPC versions prior to 1.18.0 is susceptible to an uncontrolled recursion issue, which can result in server crashes. This vulnerability arises when the parser processes deeply nested mcpack data, which can exceed system stack limits and lead to a crash. Attackers exploiting this vulnerability could send specially crafted requests, leading to unbounded recursion and resource exhaustion. It is essential for users of bRPC to either upgrade to version 1.18.0, which includes an enforced parsing depth limit of 128, or apply the available patch to safeguard their servers.

References